docs planning RUST_STATION_INGESTION_RST05

RST-05 — Owned Go loader with staging tests

Status: IMPLEMENTED — staging only; no publication change, no new service, no new credentials. Date: 2026-10-09. Scope: RUST_STATION_INGESTION_PLAN.md RST-05. Language: English document; user communication in Portuguese.

1. What was added

• Migration 000049_registry_station_prep_source.sql (append-only): registry_source_runs.source accepts station-prep alongside the two existing sources. Existing rows are unaffected; official-lookup reads keep their current source scope until a tested publication change says otherwise.
• registry/loadbatch.go — LoadBatch validates a station-batch-v1 manifest plus its three JSONL streams without touching the store (format/UUID/versions, stream SHA256/sizes/row counts, strict JSON schemas, kernel CNPJ checks, CHECK-set membership, per-input accounting), then stages one run per manifest input through the existing Store: snapshot station-prep:<run_id>:<input_key>, idempotent replay via the unique snapshot key, live count agreement, succession links resolved to staged identities, complete only on full agreement. Anything else finishes the run as failed, never complete, so the existing complete-run reconciler stays blind to partial work.
• Hard gates: assertion streams must stay unknown quality without coordinates; candidate streams must stay pending review without accuracy claims; candidate points re-validate against national bounds; quarantine reasons stay in the frozen set. Derived candidate checksums use the same canonical recipe as station-prep.
• Store gains SetAssertionSuperseded (PG + fakes); no query text changed, so no sqlc regeneration was needed.

2. Evidence (revision a131ce6 + working tree)

• Unit (fake): valid batch stages 3+2 rows with exact counts and one succession link; six invalid batches (bad format, tampered stream, skewed counts, bad CNPJ, unknown reason, reviewed smuggling) fail before any run exists; replay converges; store errors and silent count skews finish runs as failed.
• Real disposable PostGIS with -race: empty batch completes with zero rows; pre-migration CSV source coexists and bogus sources still violate the CHECK; 4-way concurrent reloads converge on stable run IDs and row counts; tampered streams complete nothing; replay keeps assertion identities; mid-load failure completes nothing new; a least-privilege role (CONNECT + USAGE + SELECT/INSERT/UPDATE on the two staging tables) loads successfully yet gets permission-denied on canonical stations. Credentials only via ANPFUEL_TEST_DATABASE_URL.
• go build ./..., go vet on the module and gofmt clean. Local staticcheck binary predates the pinned toolchain (export-data mismatch) and was not runnable here; the pinned CI staticcheck owns that signal.

3. Limits and next task

• FindOfficialAssertion source scope is unchanged: staged station-prep rows reconcile through existing runs but official reads need their own tested publication decision.
• Loader trusts manifest input hashes as recorded provenance (raw bytes are verified upstream at fetch/emit); it proves stream bytes against the manifest itself.
• Next (smallest): RST-06 location review gate — tested CRS transform, independent reference sample and evidence-backed promotion/rejection with 150m/fix-integrity cases on real PostGIS.